Static task
static1
Behavioral task
behavioral1
Sample
c520a4bd80d25b5b32399bba3ef5c6e682c615897ba2fef260b62e5c9c209b38.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
c520a4bd80d25b5b32399bba3ef5c6e682c615897ba2fef260b62e5c9c209b38.dll
Resource
win10v2004-20231020-en
General
-
Target
c520a4bd80d25b5b32399bba3ef5c6e682c615897ba2fef260b62e5c9c209b38
-
Size
78KB
-
MD5
76e4ab1e05186b15487c7e7ceb23a8a8
-
SHA1
4f5fa74240823726cfc13195ec554430255eb78a
-
SHA256
c520a4bd80d25b5b32399bba3ef5c6e682c615897ba2fef260b62e5c9c209b38
-
SHA512
6213ffe2094a10bfffe4ad883898382d01b6e87301f403e9e86e55a252f19384409ddc483618419f15181084447ef7e3263e280b7d77df9c319459e93f6e136a
-
SSDEEP
1536:UJp+KZSed9yV2E9Mv7OJhvUvfD9HLSriYAvaeuzuxycK9791T:UJ0ned9yVKv7ObUv79HJxv6vx9R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c520a4bd80d25b5b32399bba3ef5c6e682c615897ba2fef260b62e5c9c209b38
Files
-
c520a4bd80d25b5b32399bba3ef5c6e682c615897ba2fef260b62e5c9c209b38.dll windows:5 windows x64
06d96a4569d424e7c94715985ffda483
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
ExFreePoolWithTag
strlen
ExAllocatePool
RtlCompareMemory
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
IofCallDriver
NtClose
IoReuseIrp
ZwSetInformationFile
ZwWriteFile
ZwCreateFile
RtlAppendUnicodeToString
ZwQueryInformationFile
ObfReferenceObject
ZwReadFile
ExAllocatePoolWithTag
ZwDeleteFile
wcscat
wcscpy
wcslen
ZwQueryDirectoryFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQueryTimeIncrement
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQueryValueKey
__C_specific_handler
atoi
strstr
_vsnprintf
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
rand
srand
CmUnRegisterCallback
CmRegisterCallback
RtlCompareUnicodeString
ZwCreateKey
RtlQueryRegistryValues
MmSystemRangeStart
_itoa_s
PsCreateSystemThread
IoCreateSymbolicLink
RtlUnicodeStringToAnsiString
_vsnwprintf
IoCreateDevice
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
IofCompleteRequest
ObQueryNameString
RtlFreeAnsiString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
ZwQuerySystemInformation
KeUnstackDetachProcess
ObSetHandleAttributes
PsInitialSystemProcess
IoGetCurrentProcess
KeStackAttachProcess
PsLookupProcessByProcessId
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ